22

I have read many places that the access token session length is controlled by the client application and will expire "from time to time", but I cannot find a way for my application to calculate the expiration date/time.

I have used other non-Salesforce systems and they pass along an expires_in value to help determine the expiration.

Salesforce does pass along an issued_at value, which doesn't help me much.

Is there a way to determine when the access token will expire, or is it only based on trial and error?

Improve this question

3 Answers 3

Reset to default
31

Sessions expire based on your organization's policy for sessions. Basically, as long as the app is in active use, the session won't expire. Once the session is logged out, the timeout has elapsed, or it is otherwise expired (e.g. an administrator expires all sessions for the Connected App).

There's no way to know how long it will be until your session expires. It's not exactly "trial and error," it is simply a normal process. Even if you were told that your session expired in two hours, it might not last two hours if an administrator revokes the session, the session remains in use, etc.

If you use refresh tokens, your code should first try the regular API call, and if you get a 4xx result, try using the refresh token to get a new session token, and if that fails, then you've been kicked out, and the user needs to re-authenticate to continue. If you don't use refresh tokens, you can skip the middle step, obviously.

Improve this answer
2
  • Thanks. That is very helpful. So, if I have a scheduled service/cron running Bulk Api actions and also real time Rest Api actions, should I use multiple connected apps? Is there a standard way to manage the access token usage so one process does not invalidate the access token while the other process is "working"? Would it make sense for this to be its own question?
    – Brad Ullery
    Commented Apr 28, 2015 at 14:09
  • 3
    You should probably ask a separate question for a longer answer, but yes, each app should use its own connected app. 1. You can only have five active sessions per app. 2. Sharing tokens can cause failures on all apps if one is logged out. 3. You can identify misbehaving apps easier if they each use their own session token.
    – sfdcfox ♦
    Commented Apr 28, 2015 at 14:44
7

There's an introspection endpoint that's been introduced recently, that allows you to ask for info about a refresh token or access token.

OpenID Connect Token Introspection Endpoint

More details here at Salesforce

The following is a sample request to the token introspection endpoint:

POST /services/oauth2/introspect HTTP/1.1
Host: myorg.salesforce.com
Accept: application/json
Content-Type: application/x-www-form-urlencoded
Authorization: Basic client_id=3MVG9lKcPoNINVBIPJjdw1J9LLM82HnFVVX19KY1
uA5mu0QqEWhqKpoW3svG3XHrXDiCQjK1mdgAvhCscA9GE&client_secret=
1955279925675241571

token=00DR00000009GVP!ARQAQE5XuPV7J4GoOu3wvLZjZI_TxoBpeZpRb6d8AVdII6cz
_BY_uu1PKxGeAjkSvO0LpWoL_qfbQWKlXoz1f2ICNiy.6Ndr&
token_type_hint=access_token

and here's a sample response

HTTP/1.1 200 OK
Content-Type: application/json

{
"active":true,
"scope":"id api web full refresh_token openid",
"client_id":"OAuthSp",
"username":"[email protected]",
"sub":"https://login.salesforce.com:
6109/id/00Dxx0000001gEREAY/005xx000001Sv6AAAS",
"token_type":"access_token",
"exp":1528502109,
"iat":1528494909,
"nbf":1528494909
}
Improve this answer
6
  • 3
    The link to Salesforce is dead by now as they continuously move stuff around (and don't bother redirecting). Maybe this is the same article? help.salesforce.com/…
    – Andreas Warberg
    Commented Jun 23, 2020 at 11:53
  • @AndreasWarberg - looks right to me - thanks - I will update the link!
    – Brad Parks
    Commented Jun 24, 2020 at 11:37
  • Hey @BradParks: I am using this to check information about an access_token generated via JWT flow, but I am getting "invalid client" error. I have checked "Introspect All Tokens" settings and also added opened to the scope. I am using Postman to test. Can you please tell me, what can be error? I want to know how long is the access_token valid.
    – ankittaneja
    Commented Jul 13, 2021 at 9:54
  • 1
    Note for anyone else coming across this: introspection DOES NOT work for sessions obtained via JWT token, since it's not a true OAuth2 connection. As with many other aspects of the JWT token flow, it isn't treated the same. The invalid_client message means that the JWT token session isn't recognized for introspection, period.
    – b. e. hollenbeck
    Commented Mar 7, 2022 at 1:05
  • 2
    The endpoint has changed again. Client Id and Secret are now sent as part of the form, not in the Authorization header. And it does work in the JWT flow, just tried it. See the awesome Postman Collection. github.com/forcedotcom/postman-salesforce-apis
    – xouns
    Commented Sep 9, 2022 at 13:45
0

The best way would be to send a request with same existing token and verify the response code. We have done this in our application. if in case it is expired then we used to request the auth token once again with the app credentials.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .